recoup-music-video
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npxto run thehyperframesutility (version 0.7.5) for project linting, validation, and snapshotting tasks. It also invokesffmpegandffprobefor media processing and audio gain management. - [EXTERNAL_DOWNLOADS]: The workflow integrates external agent skills from the
OSideMediaGitHub repository for character design and scene auditing, as well as vendor-specific skills for song generation and platform access. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied audio and lyric transcripts which are used to construct prompts for image and video generation models, creating an attack surface for indirect prompt injection.
- Ingestion points: External audio files and lyric transcriptions (
audio/scribe.json). - Boundary markers: The prompt construction logic for scene stills and motion (Steps 7 and 9) does not specify the use of delimiters or warnings to ignore instructions embedded in the lyrics.
- Capability inventory: Access to shell execution (
npx,ffmpeg,ffprobe) and network connectivity to the Recoup API. - Sanitization: No explicit sanitization or filtering of transcribed lyric content is mentioned prior to its inclusion in generation prompts.
Audit Metadata